6fd1b1c8e7b60935b648ffa6be50b3ce3b1144bd2d3e3d514ab86fa51e732bf3

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 12:33

Target

version.dll
Size

4.5MB
MD5

80f0d5b317e64595f1faaf57bee5587b
SHA1

5729cfb3631f5612e720b4a3956a46b9dc45bdfc
SHA256

6fd1b1c8e7b60935b648ffa6be50b3ce3b1144bd2d3e3d514ab86fa51e732bf3
SHA512

cfc3028ea62a6f72afe07df9e0ca581de487af71ecdc4d716a7ba60a48737d29ea74c54e5e9d88ba8371a795aca5145ed3421407ca070866b587490143e09fbf
SSDEEP

49152:Aiw2EoWjSZXPb91f+kK2MiwtvLKzzFodCuo1F3JfRQd50bv2mqdC/L0B1A0vCexi:Aiw4WSXPbGKzzF/uotS/4SsZ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2772	2180	rundll32.exe	30
PID 2180 wrote to memory of 2772	2180	rundll32.exe	30
PID 2180 wrote to memory of 2772	2180	rundll32.exe	30
PID 2180 wrote to memory of 2772	2180	rundll32.exe	30
PID 2180 wrote to memory of 2772	2180	rundll32.exe	30
PID 2180 wrote to memory of 2772	2180	rundll32.exe	30
PID 2180 wrote to memory of 2772	2180	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\version.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\version.dll,#1
  2⤵
  PID:2772